SC-200 Cheat Sheet: Key Facts to Review

The short version

Use this sheet in the last days before the exam, after you have studied the material. It lists the facts and look-alike pairs that scenario questions lean on. It is not a full summary, it does not cover everything on the exam, and it is no substitute for the skills outline on Microsoft Learn. The outline in use is “Skills measured as of October 21, 2026”.

Exam facts at a glance

Item	Fact (Microsoft Learn, checked October 22, 2026)
Exam	SC-200, Microsoft Security Operations Analyst
Level	Intermediate, associate credential
Time	100 minutes
Passing score	700 on a scale of 1 to 1,000 (scaled, not 70 percent)
Questions	Number not published
Penalty for wrong answers	None
Delivery	Proctored through Pearson VUE
Retakes	24 hours, then 14 days between attempts, up to five
Renewal	Every 12 months, free, unproctored assessment
Domain 1	Manage a security operations environment, 40-45%
Domain 2	Respond to security incidents, 35-40%
Domain 3	Perform threat hunting, 20-25%

Domain 1: Manage a security operations environment

Key concepts

Defender XDR automation: email and alert notifications, tuning and suppression, automated investigation and response, automatic attack disruption.
Defender for Endpoint settings: advanced features, rule settings, custom data collection, attack surface reduction (ASR) rules, device groups with permissions and automation levels.
Sentinel platform: roles, retention across the Analytics, Data lake, and XDR tiers, workbooks, SOC optimization recommendations.
Data in: connectors, Windows Security Events via AMA with data collection rules, Windows Event Forwarding, Syslog and CEF via AMA, Azure activity logs, threat indicators, custom tables.
Detections: custom detection rules, Sentinel analytics rules (scheduled, near-real-time, threat intelligence, machine learning), ATT&CK coverage, anomalies.

Easily confused pairs

An automation rule decides when and what happens to an incident or alert in Sentinel. A playbook is the workflow that runs the steps.
A custom detection rule lives in Defender XDR and runs on advanced hunting data. An analytics rule lives in Sentinel and runs on workspace data.
A data collection rule shapes what an agent sends. A connector is how a source is attached.
The Analytics tier is for data you query and alert on often. The Data lake tier is for cheaper long-term storage. Know why a table sits where it does.

Decision rules

If the scenario says “least privilege” for a Sentinel user, pick the narrowest role that still does the job.
If it says the log must be collected from Linux or network devices, think Syslog or CEF through the Azure Monitor Agent.
If it says “block without changing production”, think audit mode first for ASR rules.
If it says “repeat the same response for many incidents”, think automation rule plus playbook.

Traps

Picking the tool you know best instead of the one the requirement names.
Missing a cost or retention constraint in the last sentence.

Domain 2: Respond to security incidents

Key concepts

Incidents combine alerts across products. Triage, investigate entities, remediate, then record the outcome through case management.
Sources: Defender for Office 365, Defender for Cloud, Defender for Cloud Apps, Defender for Identity, Entra ID, Purview, Sentinel.
Defender for Endpoint: device timeline, live response, investigation packages, evidence and entity investigation, incidents from automatic attack disruption.
Microsoft 365 investigation: Purview Audit, content search in eDiscovery, Microsoft Graph activity logs.

Easily confused pairs

Isolate a device cuts it off from the network except for the Defender service. Restricting app execution allows only trusted apps to run. Know which action keeps what.
Audit searches recorded activity. Content search finds the content itself. Graph activity logs show API calls made against Microsoft Graph.
A compromised identity points to Entra ID and Defender for Identity. A malicious email points to Defender for Office 365.

Decision rules

If the scenario says “the attacker is moving between machines”, look for lateral movement evidence and widen the investigation, do not stay on one device.
If it says “collect files for later analysis”, think investigation package.
If it says “run commands on the device remotely”, think live response.
Contain first when the scenario stresses speed, investigate deeply when it stresses evidence.

Traps

Choosing a remediation that works but is broader than the requirement asks.
Forgetting which portal or log holds the answer.

Domain 3: Perform threat hunting

Key concepts

Pick the table first. Device events, email events, identity sign-ins, and alert tables each hold different facts.
Advanced hunting in Defender XDR, hunting queries in Sentinel, KQL jobs and summary rule tables in the data lake, notebooks, hunting graphs with blast radius, threat analytics.

KQL reminders

`where` filters rows. `project` picks columns. `extend` adds a calculated column. `summarize` groups and aggregates. `count` returns a number of rows.
`has` matches whole terms and is faster. `contains` matches any substring.
`join` combines tables on a key. `union` stacks tables. Know which join kind keeps or removes matches.
`ago()` for time windows, `bin()` for time buckets, `top` and `take` for limits.

Decision rules

If the question describes a result like “count per user per hour”, think `summarize` with `bin()`.
If it asks for events with no matching partner event, think an anti join kind.

Traps

Using a table that does not hold the event type being asked about.
Reading a query fast and missing a filter that changes the result.

What changed on October 21, 2026

Microsoft updated the English exam on that date. The change log marks the “Ingest data” group as a minor change and other groups as no change. Newer topics in the outline include the Sentinel data lake, KQL jobs, summary rules, hunting graphs, Sentinel Graph, and notebooks that connect to the Sentinel MCP Server. Localized versions follow about eight weeks later.

Last-day checklist

Re-read the three domain headings and say each subtopic out loud in one sentence.
Review your own list of look-alike pairs.
Write three KQL queries from memory.
Check your appointment time, ID, and room or software requirements.
Open the exam sandbox once if you have not seen the interface.
Sleep. A tired mind misreads constraints.

More guides for SC-200

Next step

For the reasoning behind these points, read domains explained and the exam format. The SC-200 overview lists all pages. To test recall under time pressure, use our original SC-200 practice tests.

Frequently asked questions

Does this sheet cover the whole exam?

No. It is a review aid. The skills outline on Microsoft Learn is the authority.

Are these real exam questions?

No. There are no exam questions here, and our practice questions are original.

Try the SC-200 practice exams